Samba Server加密密码远程缓冲区溢出漏洞-一一网

漏洞信息详情

Samba Server加密密码远程缓冲区溢出漏洞

CNNVD编号：CNNVD-200212-016

危害等级：超危
CVE编号：
CVE-2002-1318
漏洞类型：

边界条件错误
发布时间：

2002-11-29
威胁类型：

远程
更新时间：

2005-05-13
厂商：

hp
漏洞来源：
The Samba Team ann…

漏洞简介

Samba是一套实现SMB(Server Messages Block)协议，跨平台进行文件共享和打印共享服务的程序。
Samba服务程序没有正确检查加密密码更改请求的长度，远程攻击者可以利用这个漏洞发送恶意请求而触发缓冲区溢出，以root用户权限在系统上执行任意指令。
客户端发送一加密密码，当加密密码过长的情况下可导致在smbd堆栈上发生缓冲区溢出。samba服务程序在当从DOS代码页(code-page)转换为低端字节序(little endian)USC2 unicode时，没有对缓冲区长度进行检查，精心构建请求数据可能以root用户权限在系统上执行任意指令。
根据报告，部分由pam_smbpass PAM模块实现的应用程序可本地利用，也可能远程触发以超级管理员权限执行任意指令。
目前尚未发现有可利用代码存在。

漏洞公告

厂商补丁：
Conectiva
———
Conectiva已经为此发布了一个安全公告(CLA-2002:550)以及相应补丁:

CLA-2002:550：samba

链接：http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000550” target=”_blank”>
http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000550

补丁下载：

tp://atualizacoes.conectiva.com.br/6.0/RPMS/samba-2.0.9-2U60_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/samba-clients-2.0.9-2U60_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/samba-doc-2.0.9-2U60_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/samba-swat-2.0.9-2U60_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/samba-2.0.9-2U60_2cl.src.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-2.2.1a-1U70_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-clients-2.2.1a-1U70_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-codepagesource-2.2.1a-1U70_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-common-2.2.1a-1U70_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-doc-2.2.1a-1U70_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-swat-2.2.1a-1U70_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/samba-2.2.1a-1U70_2cl.src.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-2.2.3a-2U80_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-clients-2.2.3a-2U80_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-codepagesource-2.2.3a-2U80_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-common-2.2.3a-2U80_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-doc-2.2.3a-2U80_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-swat-2.2.3a-2U80_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/SRPMS/samba-2.2.3a-2U80_1cl.src.rpm

Conectiva Linux version 6.0及以上版本的用户可以使用apt进行RPM包的更新：

– 把以下的文本行加入到/etc/apt/sources.list文件中：

rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

(如果你不是使用6.0版本，用合适的版本号代替上面的6.0)

– 执行: apt-get update

– 更新以后，再执行: apt-get upgrade
Debian
——
Debian已经为此发布了一个安全公告(DSA-200-1)以及相应补丁:

DSA-200-1：Samba buffer overflow

链接：http://www.debian.org/security/2002/dsa-200” target=”_blank”>
http://www.debian.org/security/2002/dsa-200

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.dsc” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.dsc

Size/MD5 checksum: 1469 5db10f38dc411972fed1e8e79ac9e2cb

http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a.orig.tar.gz” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a.orig.tar.gz

Size/MD5 checksum: 5460531 b6ec2f076af69331535a82b586f55254

http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.diff.gz” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.diff.gz

Size/MD5 checksum: 116834 55b9c9ed1e423608838b5493eec9f727

Architecture independent packages:

http://security.debian.org/pool/updates/main/s/samba/samba-doc_2.2.3a-12_all.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba-doc_2.2.3a-12_all.deb

Size/MD5 checksum: 2446440 dca2cc174c245ee12e601f1ba2b115e9

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12_alpha.deb

Size/MD5 checksum: 415200 163bd412f5fd1ec9a2a125e0b1b024ba

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12_alpha.deb

Size/MD5 checksum: 598938 037ca8de5dbf1462e0c17a88c7cd35bc

http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12_alpha.deb

Size/MD5 checksum: 946742 47bdd6c9a6088326e6842265e3de6f8e

http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12_alpha.deb

Size/MD5 checksum: 1130570 8f88729028cd3cd368435bc5feb282fb

http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12_alpha.deb

Size/MD5 checksum: 622300 c22e7b482598b6c61a99410d50e1c0d6

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12_alpha.deb

Size/MD5 checksum: 488062 858e115dc3176c975c096e1328c08d49

http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12_alpha.deb

Size/MD5 checksum: 1105314 0bd614d744080ebd3383898871f73fd3

http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12_alpha.deb

Size/MD5 checksum: 1153962 8d1fcb828d6640136aaa93397fef3a4c

http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12_alpha.deb

Size/MD5 checksum: 2951852 f880e61a41534119a50a9ae282212421

arm architecture (ARM)

http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12_arm.deb” target=”_blank”>
http://security.debian.org/

参考网址

来源:US-CERT Vulnerability Note: VU#958321
名称: VU#958321
链接:http://www.kb.cert.org/vuls/id/958321

来源: BID
名称: 6210
链接:http://www.securityfocus.com/bid/6210

来源: REDHAT
名称: RHSA-2002:266
链接:http://www.redhat.com/support/errata/RHSA-2002-266.html

来源: DEBIAN
名称: DSA-200
链接:http://www.debian.org/security/2002/dsa-200

来源: XF
名称: samba-password-change-bo(10683)
链接:http://xforce.iss.net/xforce/xfdb/10683

来源: us1.samba.org
链接:http://us1.samba.org/samba/whatsnew/samba-2.2.7.html

来源: SUSE
名称: SuSE-SA:2002:045
链接:http://www.novell.com/linux/security/advisories/2002_045_samba.html

来源: MANDRAKE
名称: MDKSA-2002:081
链接:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-081.php

来源: CIAC
名称: N-023
链接:http://www.ciac.org/ciac/bulletins/n-023.shtml

来源: CIAC
名称: N-019
链接:http://www.ciac.org/ciac/bulletins/n-019.shtml

来源: SUNALERT
名称: 53580
链接:http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/53580

来源: BUGTRAQ
名称: 20021129 [OpenPKG-SA-2002.012] OpenPKG Security Advisory (samba)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=103859045302448&w=2

来源: BUGTRAQ
名称: 20021121 GLSA: samba
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=103801986818076&w=2

来源: CONECTIVA
名称: CLA-2002:550
链接:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000550

来源: SGI
名称: 20021204-01-I
链接:ftp://patches.sgi.com/support/free/security/advisories/20021204-01-I

来源: US Government Resource: oval:org.mitre.oval:def:1467
名称: oval:org.mitre.oval:def:1467
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1467